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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 01 July 2009 . 
2a )^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 15-28 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 15-28 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) ^ The drawing(s) filed on 19 May 2006 is/are: a)^ accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) ^ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)E| All b)D Some * c)D None of: 

1 Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Response to Amendment 

Applicant's arguments/ amendments with respect to pending claims 1-28 filed 7/1/1009 
have been fully considered and therefore the claims are rejected under new grounds. The 
Examiner would like to point out that this action is made final (See MPEP 706.07a). 

Information Disclosure Statement 

The information disclosure statement (IDS) submitted on 5/22/2009 was filed after the 
mailing date of the non-final office action on 4/1/2009. The submission is in compliance with 
the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being 
considered by the examiner. 

However, Examiner would like to note that Applicants also filed an NPL document 
entitled "Decision of a Patent Grant" that was not cited in the IDS. 

Claim Objections 

Claims 15 objected to because of the following informalities: in line 16, the claim as 
amended states "restriction packets f not included. . ." It seems Applicants may have intended for 
it to say "if." Appropriate correction is required. 

Also, in claims 15, 21, and 25, Applicants added the following limitations "an updated 
protection request information excluding from restriction packets not included in the attack..." In 
determining whether or not this language was supported by the Specification, Examiner would 
like to point out paragraphs 13 and 15 of the Specification which uses the word "remove" in 
reference to getting rid of the restrictions put on the packets. Examiner suggests clarifying the 
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language by replacing "excluding" with "removing" in order to remain consistent with the 
terminology presented in the Specification. 

Claim Rejections - 35 USC §103 

I. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

II. Claims 15-28 are rejected under 35 U.S.C. 103(a) as being unpatentable over Talpade et 
al., US Pub. No. 2004/0148520, and further in view of Mollenkopf, US Patent No. 6,980,090. 
As per claims 15, 21, and 25: 

Talpade et al. substantially teach a system/method/computer readable recording medium 
for protecting a communication device against a denial-of-service attack, comprising: a 
monitoring device provided on a local area network including the communication device, the 
monitoring device being configured to monitor a packet transmitted to the communication device 
via an internet-service-provider network (par. 17, lines 1-19 and par. 20); and a restricting device 
provided on the internet-service-provider network, the restricting device being configured to 
restrict a packet to the local area network (par. 17, lines 23-37), wherein the monitoring device 
includes an attack detecting unit configured to detect an attack by the packet on the 
communication device (par. 17, lines 1-12), and a protection-request-information transmitting 
unit configured to transmit protection request information indicating a request for protection 
against the attack (par. 17, lines 10-19 and par. 22); and the restricting device includes a packet 
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restricting unit configured to restrict a packet transmitted to the communication device via the 
internet-service-provider network based on the protection request information (par. 17, lines 23- 
37 and par. 24). Furthermore, Talpade et al. teach that all traffic determined to be non-DDOS 
traffic is routed back onto the ISP network (par. 33). 

Not explicitly disclosed is the protection-request-information transmitting unit being 
configured to update the protection request information to exclude from restricting packets if not 
included in the attack, based on a report transmitted from the restricting device. However, 
Mollenkopf teaches that until the source of a packet is trusted, the packet is restricted on the 
network and once the packet becomes trusted (i.e. once it is not an attack), the restrictions are 
removed by sending a message to the server (col. 25, lines 23-40). Therefore, it would have 
been obvious to a person in the art at the time the invention was made to modify the method 
disclosed in Talpade et al. to remove the restrictions from packets that were put in the category 
of being non-DDOS traffic based on the update message. This modification would have been 
obvious because a person having ordinary skill in the art, at the time the invention was made, 
would have been motivated to do so since Mollenkopf suggests that once the source of a packet 
is trusted, it allows for the packet to be processed without restrictions by allowing it to 
communicate through the communication line to all parts of the Internet in col. 25, lines 33-40. 
As per claims 16, 22, and 26: 

Talpade et al. and Mollenkopf substantially teach the system/method/computer readable 
recording medium according to claims 15, 21, and 25. Furthermore, Talpade et al. teach wherein 
the monitoring device further includes a signature generating unit configured to generate a 
signature indicating a feature of a packet that attacks the communication device, the protection- 
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request-information transmitting unit transmits the protection request information including the 
signature to the restricting device, and the packet restricting unit restricts a packet corresponding 
to the signature (par. 26). 
As per claims 17, 23, and 27: 

Talpade et al. and Mollenkopf substantially teach the system/method/computer readable 
recording medium according to claims 16, 22, and 26. Furthermore, Talpade et al. teach wherein 
the restricting device further includes a signature determining unit configured to determine 
whether the protection request information including the signature is appropriate, and the packet 
restricting unit restricts a packet corresponding to a signature that is determined to be 
appropriate, and does not restrict a packet corresponding to a signature that is determined to be 
inappropriate (par. 20). 
As per claims 18, 24, and 28: 

Talpade et al. and Mollenkopf substantially teach the system/method/computer readable 
recording medium according to claims 16, 22, and 26. Furthermore, Talpade et al. teach wherein 
the restricting device further includes a report generating unit configured to generate a report 
including a feature and an amount of packets corresponding to the signature, and a report 
transmitting unit configured to transmit the report to the monitoring device (par. 20 and par. 22), 
the signature generating unit generates a new signature based on the report, the protection- 
request-information transmitting unit transmits the protection request information including the 
new signature to the restricting device (par. 26), and the packet restricting unit restricts a packet 
corresponding to the new signature (par. 26 and par. 34). 
As per claim 19: 
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Talpade et al. and Mollenkopf substantially teach the system according to claim 18. 
Furthermore, Talpade et al. teach wherein the restricting device further includes a forwarding 
unit configured to forward the protection request information to other restricting devices 
provided on the internet-service-provider network (par. 27), the forwarding unit being configured 
to determine whether to forward the protection request information based on the report generated 
by the report generating unit. 
As per claim 20: 

Talpade et al. and Mollenkopf substantially teach the system according to claim 17. 
Furthermore, Talpade ct al. teach wherein the restricting device further includes a determination- 
result transmitting unit configured to transmit a determination result of the signature determining 
unit to the monitoring device, the signature generating unit of the monitoring device generating a 
new signature indicating the feature of the packet that attacks the communication device when 
the determination result indicates that the signature is inappropriate (par. 34). 



^References Cited, Not Used 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

1. US Pub. No. 2004/0250124 

2. US Patent No. 6301668 

3. US Pub. No. 2002/0087885 

4. US Pub. No. 2003/0135762 

5. US Pub. No. 2003/0145226 

6. US Patent No. 6,609,205 

7. US Pub. No. 2004/0054925 

8. US Pub. No. 2004/0128550 

9. US Pub. No. 2004/0172557 

10. US Pub. No. 2004/0199793 

The above references have been cited because they are relevant due to the manner in which the 
invention has been claimed. 
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Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Nadia Khoshnoodi whose telephone number is (571) 272-3825. 
The examiner can normally be reached on M-F: 8:00-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

/Nadia Khoshnoodi/ 
Examiner, Art Unit 2437 
11/20/2009 
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/Emmanuel L. Moise/ 
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